Skip to content

Phase Readiness Tracker

Reference: Implementation_Roadmap.md

Document Role

  • Purpose: readiness and gate-status dashboard across architecture, governance, ops, and implementation baseline.
  • Scope: phase-level readiness state, evidence links, and open gating items.
  • For commit-by-commit delivery tracking, use doc/Execution_Progress.md.
  • For the current execution queue and ownership state, use doc/governance/Agent_Work_Queue.yaml.

Status Key

  • Not Started
  • In Progress
  • Ready for Signoff
  • Signed Off
  • Completed (Doc Baseline)

Current Snapshot (As of 2026-02-24)

Completed

  • Target architecture, trust boundaries, ADR set, and domain ownership map finalized.
  • PRD and UX journeys aligned with architecture and policy decisions.
  • OpenAPI and AsyncAPI contracts hardened for API-first development.
  • ERD + db_schema_v1.sql stabilized with financial, idempotency, and integrity constraints.
  • Governance baseline finalized (coding standards, security controls, testing standards, contract invariants, enforcement policies, reviewguard draft).
  • Local development environment baseline documented (operations/local-dev/*).
  • CI platform selected and wired for GitLab-first execution (.gitlab-ci.yml + scripts/ci/*).
  • Core process scaffolds implemented and runnable (cmd/api, cmd/outbox-relay, cmd/notification-relay, cmd/billing-worker, cmd/provisioning-worker, cmd/webhook-worker).
  • First API vertical slice implemented (POST /api/v1/allocations -> DB allocation row + outbox event in one transaction).
  • Admin token deny-list enforcement path implemented in auth middleware.

Open

  • Track and schedule items from operations/Scalability_Security_Watchlist.md into execution phases.
  • Evidence: operations/Watchlist_Phase_Schedule.md
  • Execute owner-assigned items from operations/Parallel_Ops_Track.md and attach evidence.
  • Evidence baseline linked per item in operations/Parallel_Ops_Track.md
  • Evidence artifact set created in operations/evidence/*
  • PKI/step-ca staging readiness evidence tracker: operations/evidence/pki_stepca_staging_readiness.md (Task C-OPS-002)
  • Pending: concrete staging/production execution artifacts for launch-critical items 1-5 (SLO/alerts, runbooks/on-call drills, backup/restore DR, secrets/key ops, east/west security + cert lifecycle).

Implementation Execution Progress (Code, not just docs)

  • Status: In Progress
  • Evidence (recent commits):
  • c88416a repo hygiene update for local snapshot artifacts (exports/ ignored).
  • 70a7916 outbox relay runtime + leased claims + NATS publisher wiring.
  • 3989917 notification relay NATS->Redis scaffold + typed notification transforms.
  • 1a4e1c8 billing worker pull-consumer runtime scaffold.
  • dc6e0e4 provisioning worker pull-consumer runtime scaffold.
  • d4d4f91 webhook worker runnable ingest scaffold + outbox enqueue path.
  • e13afa2 admin token deny-list checks in auth middleware.
  • a142a74 first allocation vertical slice + outbox retry/backoff hardening.
  • e05784f CI gate tightening (go vet, contract token-query guard).
  • a7f7c0b ops evidence-gate wiring in CI/local make targets.
  • 0108acd admin deep-link query propagation across ops pages.
  • 60277de webhook reconciliation observability counters + internal stats endpoint.
  • 950edb7 webhook Prometheus counters for alert wiring (/metrics).
  • 8cb82a5 integration smoke default DB wiring (runs when local DB reachable).
  • 15cf6b6 security scan stage upgraded from scaffold to tool-aware gate.
  • 01103cb webhook internal stats endpoint bearer-token protection for local/prod-safe operation.
  • f179362 contract validation log-noise filtering for AsyncAPI node-config warnings.
  • 80d9cf6 constant-time token compare hardening for webhook internal stats auth.
  • 47f268f API internal stats + Prometheus metrics export for rate-limit/idempotency/terminal/notification observability.
  • Reference:
  • doc/Execution_Progress.md for phase-mapped implementation checklist and next queue.
  • Latest verification sweep (green): unit tests, vet, selected integration, local CI dry-run, demo smoke.

Phase 1: Architecture, Trust Boundaries, Tech Stack

  • Status: Completed (Doc Baseline)
  • Evidence:
  • architecture/Architecture_v1.md
  • architecture/Tech_Stack.md
  • architecture/Domain_Ownership_Map.md
  • architecture/adrs/*
  • Remaining for Signoff:
  • Team review/freeze of ADR texts.
  • Confirm stack freeze alignment in architecture/Tech_Stack.md Section 0 and record ADR updates if any deviations are needed.

Phase 2: Domain Model, State Machines, Data Flows

  • Status: Completed (Doc Baseline)
  • Evidence:
  • architecture/State_Machines.md
  • architecture/Sequence_Flows.md
  • architecture/Event_Taxonomy.md
  • architecture/Compensation_Matrix.md

Phase 3: API Contracts (OpenAPI + AsyncAPI)

  • Status: Completed (Doc Baseline)
  • Evidence:
  • api/openapi.draft.yaml
  • api/asyncapi.draft.yaml
  • api/API_Surface.md
  • governance/Contract_Versioning_Policy.md
  • Remaining for Execution:
  • Integrate validation/lint steps in real CI using selected CI workflow.

Phase 4: ERD and Persistence Model

  • Status: Completed (Doc Baseline)
  • Evidence:
  • architecture/ERD.md
  • architecture/db_schema_v1.sql
  • architecture/Schema_Migration_Plan.md
  • architecture/Partitioning_and_Retention_Strategy.md
  • Note:
  • No historical data migration required for launch (greenfield path).

Phase 5: Security Architecture and Threat Model

  • Status: Completed (Doc Baseline)
  • Evidence:
  • governance/Security_Threat_Model.md
  • governance/Security_Control_Verification.md
  • governance/Abuse_Case_Catalog.md
  • governance/Pen_Test_Scope.md

Phase 6: DevOps and Delivery Architecture

  • Status: Completed (Doc Baseline)
  • Evidence:
  • governance/CI_Enforcement_Checklist.md
  • governance/Pipeline_Blueprint.md
  • governance/CI_Pipeline_Implementation.md
  • governance/reviewguard_policy_draft.yaml
  • operations/Environment_Promotion_Policy.md

Phase 7: Contract Testing and Integration Strategy

  • Status: Completed (Doc Baseline)
  • Evidence:
  • governance/Testing_Standards.md
  • governance/Test_Ownership_Matrix.md
  • governance/Test_Data_Strategy.md

Phase 8: Operations and SRE Readiness

  • Status: Completed (Doc Baseline)
  • Evidence:
  • operations/local-dev/README.md
  • operations/local-dev/docker-compose.yaml
  • operations/SRE_Runbook_Index.md
  • operations/Incident_Severity_Model.md
  • operations/Observability_Baseline.md
  • operations/runbooks/API_Degradation_Runbook.md
  • operations/runbooks/Queue_Backlog_Runbook.md
  • operations/runbooks/Billing_Worker_Failure_Runbook.md

Immediate Next Sequence

  1. Execute owner-assigned launch-critical operations tracks (items 1–5) and attach concrete execution evidence in operations/Parallel_Ops_Track.md.
  2. Prioritize remaining watchlist pre-beta items that are still open (encryption envelope enforcement follow-through, fail-open alerts, SSRF/network validation, idempotency sanitization ops checks).
  3. Keep CI gates green via make ci-local-dry-run and remote GitLab pipeline parity.